Analysis
-
max time kernel
103s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07-01-2024 20:25
Static task
static1
Behavioral task
behavioral1
Sample
49ae90c1479fa19fcface2ef9c1c6bb8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
49ae90c1479fa19fcface2ef9c1c6bb8.exe
Resource
win10v2004-20231222-en
General
-
Target
49ae90c1479fa19fcface2ef9c1c6bb8.exe
-
Size
1.8MB
-
MD5
49ae90c1479fa19fcface2ef9c1c6bb8
-
SHA1
5ea3e5e103a4875d43d3fa694f182e5aa48526a6
-
SHA256
acaa96229403e39ba1665e34d0e876685d8ee5fb6c006add9b4f6c0b709cba6e
-
SHA512
193efa34aa6b2f38c73d6a2cb0544233d3dc354de10e10369c9754e07d78fdf3c5c1660d02e009981f85b6d0a4d364c5a8a6027a9e01f2ff75cc96a9d4efc5a2
-
SSDEEP
49152:EH9WHhlw9pyJBxSZcNhaLVVo8xMWgXQH+:EsBlw9pqhaxVo8XMS+
Malware Config
Extracted
pandastealer
1.11
http://spacesecurity.fun
Signatures
-
Panda Stealer payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1020-12-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer behavioral1/memory/1020-14-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer behavioral1/memory/1020-17-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer behavioral1/memory/1020-19-0x0000000000400000-0x00000000004AE000-memory.dmp family_pandastealer -
PandaStealer
Panda Stealer is a fork of CollectorProject Stealer written in C++.
-
CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
Processes:
resource yara_rule behavioral1/memory/2804-3-0x0000000000470000-0x0000000000482000-memory.dmp CustAttr -
Suspicious use of SetThreadContext 1 IoCs
Processes:
49ae90c1479fa19fcface2ef9c1c6bb8.exedescription pid process target process PID 2804 set thread context of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1720 1020 WerFault.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
49ae90c1479fa19fcface2ef9c1c6bb8.exepid process 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
49ae90c1479fa19fcface2ef9c1c6bb8.exedescription pid process Token: SeDebugPrivilege 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe -
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
49ae90c1479fa19fcface2ef9c1c6bb8.exe49ae90c1479fa19fcface2ef9c1c6bb8.exedescription pid process target process PID 2804 wrote to memory of 748 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 748 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 748 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 748 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 2804 wrote to memory of 1020 2804 49ae90c1479fa19fcface2ef9c1c6bb8.exe 49ae90c1479fa19fcface2ef9c1c6bb8.exe PID 1020 wrote to memory of 1720 1020 49ae90c1479fa19fcface2ef9c1c6bb8.exe WerFault.exe PID 1020 wrote to memory of 1720 1020 49ae90c1479fa19fcface2ef9c1c6bb8.exe WerFault.exe PID 1020 wrote to memory of 1720 1020 49ae90c1479fa19fcface2ef9c1c6bb8.exe WerFault.exe PID 1020 wrote to memory of 1720 1020 49ae90c1479fa19fcface2ef9c1c6bb8.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\49ae90c1479fa19fcface2ef9c1c6bb8.exe"C:\Users\Admin\AppData\Local\Temp\49ae90c1479fa19fcface2ef9c1c6bb8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\49ae90c1479fa19fcface2ef9c1c6bb8.exe"C:\Users\Admin\AppData\Local\Temp\49ae90c1479fa19fcface2ef9c1c6bb8.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\49ae90c1479fa19fcface2ef9c1c6bb8.exe"C:\Users\Admin\AppData\Local\Temp\49ae90c1479fa19fcface2ef9c1c6bb8.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 1363⤵
- Program crash
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1020-14-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1020-12-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1020-8-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1020-19-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1020-9-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1020-17-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/1020-15-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1020-10-0x0000000000400000-0x00000000004AE000-memory.dmpFilesize
696KB
-
memory/2804-5-0x0000000004E20000-0x0000000004E60000-memory.dmpFilesize
256KB
-
memory/2804-4-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2804-7-0x0000000008380000-0x0000000008436000-memory.dmpFilesize
728KB
-
memory/2804-2-0x0000000004E20000-0x0000000004E60000-memory.dmpFilesize
256KB
-
memory/2804-0-0x0000000000E10000-0x0000000000FDA000-memory.dmpFilesize
1.8MB
-
memory/2804-6-0x0000000008280000-0x000000000837E000-memory.dmpFilesize
1016KB
-
memory/2804-1-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2804-20-0x00000000744D0000-0x0000000074BBE000-memory.dmpFilesize
6.9MB
-
memory/2804-3-0x0000000000470000-0x0000000000482000-memory.dmpFilesize
72KB